The `ldd` utility is more vulnerable than you think. It's frequently used by programmers and system administrators to determine the dynamic library dependencies of executables. Sounds pretty innocent, right? Wrong!

In this article I am going to show you how to create an executable that runs arbitrary code if it's examined by `ldd`. I have also written a social engineering scenario on how you can get your sysadmin to unknowingly hand you his privileges.

I researched this subject thoroughly and found that it's almost completely undocumented. I have no idea how this could have gone unnoticed for such a long time. Here are the only few documents that mention this interesting behavior: 1, 2, 3, 4.

First let's understand how `ldd` works. Take a look at these three examples:

The first command [1] runs `ldd` on `/bin/grep`. The output is what we expect -- a list of dynamic libraries that `/bin/grep` depends on.

The second command [2] sets the LD_TRACE_LOADED_OBJECTS environment variable and seemingly executes `/bin/grep` (but not quite). Surprisingly the output is the same!

The third command [3] again sets the LD_TRACE_LOADED_OBJECTS environment variable, calls the dynamic linker/loader `ld-linux.so` and passes `/bin/grep` to it as an argument. The output is again the same!

What's going on here?

It turns out that `ldd` is nothing more than a wrapper around the 2nd and 3rd command. In the 2nd and 3rd example `/bin/grep` was never run. That's a peculiarity of the GNU dynamic loader. If it notices the LD_TRACE_LOADED_OBJECTS environment variable, it never executes the program, it outputs the list of dynamic library dependencies and quits. (On BSD `ldd` is a C program that does the same.)

If you are on Linux, take a look at the `ldd` executable. You'll find that it's actually a bash script. If you step through it very carefully, you'll notice that the 2nd command gets executed if the program specified to `ldd` can't be loaded by the `ld-linux.so` loader, and that the 3rd command gets executed if it can.

One particular case when a program won't be handled by `ld-linux.so` is when it has a different loader than the system's default specified in it's .interp ELF section. That's the whole idea in executing arbitrary code with `ldd` -- load the executable via a different loader that does not handle LD_TRACE_LOADED_OBJECTS environment variable but instead executes the program.

For example, you can put a malicious executable in ~/app/bin/exec and have it loaded by ~/app/lib/loader.so. If someone does `ldd /home/you/app/bin/exec` then it's game over for them. They just ran the nasty code you had put in your executable. You can do some social engineering to get the sysadmin to execute `ldd` on your executable allowing you to gain the control over the box.

Compiling the new loader.

Get the uClibc C library. It has pretty code and can be easily patched to bypass the LD_TRACE_LOADED_OBJECTS checks.

Edit .config and set the destination install directory to `/home/you/app/uclibc`.

# change these two lines
RUNTIME_PREFIX="/usr/$(TARGET_ARCH)-linux-uclibc/"
DEVEL_PREFIX="/usr/$(TARGET_ARCH)-linux-uclibc/usr/"
# to this
RUNTIME_PREFIX="/home/you/app/uclibc/"
DEVEL_PREFIX="/home/you/app/uclibc/usr/"

Now we'll need to patch it to bypass LD_TRACE_LOADED_OBJECTS check.

Here is the patch. It patches the `ldso/ldso/ldso.c` file. Save the patch to a file and run `patch -p0 < file`. If you don't do it, arbitrary code execution won't work, because it will think that `ldd` wants to list dependencies.

This is the most basic code. It checks if LD_TRACE_LOADED_OBJECTS env variable is set or not. If the variable set, the program acts maliciously but if it's not, the program acts as if nothing happened.

The compilation is somewhat complicated because we have to link with the new C library statically (because anyone who might execute our program via `ldd` will not have our new C library in their LD_LIBRARY_PATH) and specify the new loader:

Here is a more sophisticated example that I just came up with. When run without `ldd` this application fails with a fictitious "error while loading shared libraries" error. When run under `ldd` it checks if the person is root, and owns the box. After that it fakes `ldd` output and pretends to have `libat.so.0` missing.

This code needs a lot of improvements and just illustrates the main ideas.

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>
/*
This example pretends to have a fictitious library 'libat.so.0' missing.
When someone with root permissions runs `ldd this_program`, it does
something nasty in malicious() function.
I haven't implemented anything malicious but have written down some ideas
of what could be done.
This is, of course, a joke program. To make it look more real, you'd have
to bump its size, add some more dependencies, simulate trying to open the
missing library, detect if ran under debugger or strace and do absolutely
nothing suspicious, etc.
*/
void pretend_as_ldd()
{
printf("\tlinux-gate.so.1 => (0xffffe000)\n");
printf("\tlibat.so.0 => not found\n");
printf("\tlibc.so.6 => /lib/libc.so.6 (0xb7ec3000)\n");
printf("\t/lib/ld-linux.so.2 (0xb8017000)\n");
}
void malicious()
{
if (geteuid() == 0) {
/* we are root ... */
printf("poof, all your box are belong to us\n");
/* silently add a new user to /etc/passwd, */
/* or create a suid=0 program that you can later execute, */
/* or do something really nasty */
}
}
int main(int argc, char **argv)
{
if (getenv("LD_TRACE_LOADED_OBJECTS")) {
malicious();
pretend_as_ldd();
return 0;
}
printf("%s: error while loading shared libraries: libat.so.0: "
"cannot open shared object file: No such file or directory\n",
argv[0]);
return 127;
}

Actually you can put the code you want to get executed right in the loader itself. This way the executable will always look clean.

Social engineering.

Most system administrators probably don't know that they should never run `ldd` on unfamiliar executables.

Here is a fake scenario on how to get your sysadmin run `ldd` on your executable.

Sysadmin's phone: ring, ring.

Sysadmin: "Mr. sysadmin here. How can I help you?"

You: "Hi. An app that I have been using has started misbehaving. I am getting weird dependency errors. Could you see what is wrong?"

Sysadmin: "Sure. What app is it?"

You: "It's in my home directory, /home/carl/app/bin/myapp. Sometimes when I run it, it says something about 'error while loading shared libraries'."

Sysadmin: "Just a sec." noise from keyboard in the background

Sysadmin: "What was it again? It must be some kind of a library problem. I am going to check its dependencies."

You: "Thanks, it's /home/carl/app/bin/myapp."

Sysadmin: "Hmm. It says it's missing `libat.so.0`, ever heard of it?"

You: "Nope, no idea... I really need to get my work done, can you check on that and get back to me?" evil grin in the background

Sysadmin: "Okay Carl, I'm gonna call you back."

You: "Thanks! See ya."

You: `mv ~/.hidden/working_app ~/app/bin/myapp`.

After a while.

Sysadmin calls: "Hi. It seems to be working now. I don't know what the problem was."

One either links with libC, or with uClibc (and accompaniying crt*.o) object(s), but not both. If mClibc is a complete libC environment, it should provide crt*.o and any other necessary objects.

What you have there after linking is a "salad", a mess; it's a miracle you're able to run it at all.

Also, if GNU ld supports $ORIGIN (like Solaris and HP-UX' ld(1)), you could link dynamically, by passing -R'$ORIGIN/../lib' to ld directly, or going through the cc(1) front end with -Wl,-R'$ORIGIN/../lib'.

I've not tried this but it looks to me like Linux will accept relative paths to ELF interpreters, allowing the toxic executable to be its own interpreter and removing the need for a stunt interpreter to be installed at a known location; all that is needed is for the victim not to rename the executable.

Hi. I know a lot of people are surprised by this little exploit but this is a well documented case in ldd. I remember this coming up as a bullet point at a local LUG meeting back in 1997 when we were installing Slackware on a box.

Needless to say, this really is an educate yourself deal as opposed to a "fix this, fix this!" exploit. You can head over to TLDP and see a clear warning about this.

I applaud the author for reminding everyone about this important issue, but (in my opinion) it really isn't a problem with ld-linux.so per se. When an executable says they are needing a different loader, the natural behavior should be to load the external loader. That alone should ring sysadmin bells, an external loader is being used...Do I trust it? All in all it comes down to a sysadmin watching their back and understanding how things work.

A superuser should use the -f option only if the executable to be examined is known to be trustworthy. The use of -f on an untrustworthy executable while superuser can compromise system security. If an executables trustworthyness is unknown, a superuser should temporarily become a regular user. Then invoke ldd as this regular user.

If you google it you can find this issue several times in the first few pages.

If you CHECK THE DOCUMENTATION for ldd, this issue is mentioned. Granted you have to read through a bunch first. But it is very clearly documented.

Security: if this is a ripoff then every article about computing Fibonacci numbers is a ripoff too, because each of them doesn't mention any links to the sources. Everyone who has read OpenBSD's man page for ldd(1) , has came to the same idea.

Peter: thanks for the article - I didn't know you could do this with stock tools without manually fiddling with the binary.

Also I just talked with someone who has been using Gentoo for a long time and he says he remember that revdep-rebuild used to run ldd on all the *.so's in the system to do some verification checks. If this was true today, all Gentoos would have been owned.

Gives various ideas to think about. For example, I was just browsing google code search and searching for "find.*ldd" to find some vulnerable scripts.

For all those pointing out that this is well documented - that might well be the case, but just how do you expect people to find that out? By searching for "root exploits in ldd"? Some people might know about it already, but it's certainly not general knowledge...

Hmm, the man page of fedora 11 does not mention any problem with ldd. As a beginner admin I would say this is rather nasty and a good to know thing. I wonder how many other "its a feature" dangers are out there and thats exactly the reason why I think a developer should make a safety net.
I know running this or that as root is not smart, but then again, nobody can ever be sure they hire an admin thats not lazy once in a while. Even the administrator needs a bit of protection against himself :p Unless you think the only good administrator is a homo universalis ;)

This is a unsafe-ldd problem is different from the old one. I remember learning that a.out ldd just ran the executable with argc=1 (i.e. argv[0]==NULL), and that would cause the dynamic a.out dynamic linker to dump library deps. Obviously that's easy to exploit, since you just need a static binary with startup code that doesn't exit with no args.

I was under the impression that ELF ldd was safe, because ld.so printed the dependencies without execing the binary directly. I don't know if it ever was safe, but it's obviously not now, I guess due to the "feature" of supporting binaries that use a non-standard dynamic linker. /sigh. Maybe that feature should only be enabled with ldd --insecure, or something.

Unfortunately there is no "ld.so": it's really /lib/ld-linux-x86-64.so.2 or ld-linux.so.2 or ld-2.9.so. I guess that's why ldd takes the insecure easy route of running the executable if it has exec permission.

While assuming a secure ldd is a bad habit, since other Unixes don't have a secure ldd, it never hurts to make a system that doesn't suffer from the same problems as other systems. Is openBSD's ldd safe on arbitrary binaries?

Thanks for this article. I was previously unaware of this problem with ldd.

Some of the responses here are troubling. To deny that there is any issue, because it is documented in some obscure places? To accuse the author of plagiarism, because there is some documentation of it, however obscure, when that documentation doesn't resemble this article at all? To dismiss the issue, because other practices, like not running ldd as root, could mitigate it? To just heap mindless abuse on the author?

Some of the respondents are displaying some of the worst stereotypes of the narrow minded computer geek with zero social skills.

Yeah, that's right, noob! I don't understand anyone bashing me here. The article is great, it got a lot of attention, many people learned about it the first time. I can't see what is the reason to be angry at me.

Peter, read all comments, take what is good in them and ignore the noise but without muting it, simply let your readers judge for themselves ;-)
And most of all, please keep up with your really great blog!!!
Greetings from Italy.

Great article, I did not know about it! I read all comments and stumbled about some strange trolls...

Well, a thing to keep at least this kind quiet is to add references to your post (I hope I did not overlook them). Refereces to sites you find mentionable to this topic. Even better, it documents your sources and this is very often a good thing.

Irrespective of what some stupids here are saying, I found the information very helpful. I won't claim to be a security expert, but I have a lot of experience with this stuff and I did find the info very helpful and actually this is the first time I've come across it. So yes, thanks. :)